APIs & Web Services: REST, Consumption & Gateways

// --- Option A: Production Native Fetch with Timeout & Guard ---
export async function fetchTelemetryNodes() {
  const controller = new AbortController();
  const timeoutId = setTimeout(() => controller.abort(), 5000); // 5-second timeout

  try {
    const res = await fetch('https://api.devascent.me/v1/nodes', {
      method: 'GET',
      headers: { 'Content-Type': 'application/json' },
      signal: controller.signal
    });

    // Mandatory: Check response.ok status
    if (!res.ok) {
      const errorPayload = await res.json();
      throw new Error(errorPayload.message || `Request failed with status ${res.status}`);
    }

    return await res.json();
  } finally {
    clearTimeout(timeoutId);
  }
}

// --- Option B: Production Axios Client with Global Interceptors ---
import axios from 'axios';

export const apiClient = axios.create({
  baseURL: 'https://api.devascent.me/v1',
  timeout: 5000,
  headers: { 'Content-Type': 'application/json' }
});

// Request Interceptor: Automatically injects JWT
apiClient.interceptors.request.use((config) => {
  const token = localStorage.getItem('auth_token');
  if (token) {
    config.headers.Authorization = `Bearer ${token}`;
  }
  return config;
});

// Response Interceptor: Catches 401s globally
apiClient.interceptors.response.use(
  (response) => response.data, // Unwraps data payload automatically
  (error) => {
    if (error.response?.status === 401) {
      console.warn('Session expired. Redirecting to login...');
      window.location.href = '/login';
    }
    return Promise.reject(error.response?.data || error);
  }
);

import express from 'express';
import rateLimit from 'express-rate-limit';

const router = express.Router();

// Rate Limiting Guard: Max 100 requests per 15-minute window per IP
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  standardHeaders: true, // Returns standard 'RateLimit-*' headers
  legacyHeaders: false,
  message: { error: 'Too many requests. Try again in 15 minutes.' }
});

router.get('/telemetry', apiLimiter, async (req, res) => {
  // Sanitize pagination parameters
  const page = Math.max(1, parseInt(req.query.page, 10) || 1);
  const limit = Math.min(100, Math.max(1, parseInt(req.query.limit, 10) || 20));
  const offset = (page - 1) * limit;

  // Simulated database response with metadata
  const mockData = [{ id: 'node-1' }, { id: 'node-2' }];
  const totalRecords = 42;

  return res.status(200).json({
    success: true,
    pagination: {
      currentPage: page,
      perPage: limit,
      totalItems: totalRecords,
      totalPages: Math.ceil(totalRecords / limit)
    },
    data: mockData
  });
});

export default router;

import swaggerUi from 'swagger-ui-express';
import swaggerJsdoc from 'swagger-jsdoc';

// OpenAPI Specification Definition
const swaggerOptions = {
  definition: {
    openapi: '3.0.0',
    info: {
      title: 'DevAscent Telemetry Gateway API',
      version: '1.0.0',
      description: 'Production API documentation with live interactive testing'
    },
    servers: [{ url: 'http://localhost:5000/api/v1' }]
  },
  apis: ['./routes/*.js'] // Path to files containing @openapi comments
};

const swaggerSpec = swaggerJsdoc(swaggerOptions);
app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(swaggerSpec));

/**
 * @openapi
 * /nodes/{id}:
 *   get:
 *     summary: Retrieve single telemetry node by UUID
 *     parameters:
 *       - in: path
 *         name: id
 *         required: true
 *         schema:
 *           type: string
 *     responses:
 *       200:
 *         description: Node retrieved successfully
 *       404:
 *         description: Node not found
 */

// Simple in-memory cache to save external API costs and latency
const weatherCache = new Map();

app.get('/api/v1/weather', async (req, res, next) => {
  try {
    const city = (req.query.city || 'London').toLowerCase();
    const cacheKey = `weather_${city}`;

    // 1. Check cache (expires after 10 minutes)
    const cached = weatherCache.get(cacheKey);
    if (cached && (Date.now() - cached.timestamp < 10 * 60 * 1000)) {
      return res.status(200).json({ source: 'cache', data: cached.payload });
    }

    // 2. Backend securely injects secret API key from environment
    const apiKey = process.env.OPENWEATHER_API_KEY;
    const url = `https://api.openweathermap.org/data/2.5/weather?q=${city}&units=metric&appid=${apiKey}`;

    const apiResponse = await fetch(url);
    if (!apiResponse.ok) {
      return res.status(apiResponse.status).json({ error: 'Weather provider lookup failed.' });
    }

    const rawData = await apiResponse.json();
    
    // 3. Sanitize and transform only the fields your UI requires
    const sanitizedData = {
      location: rawData.name,
      temperatureC: rawData.main.temp,
      conditions: rawData.weather[0].description,
      humidity: rawData.main.humidity
    };

    // Store in cache
    weatherCache.set(cacheKey, { timestamp: Date.now(), payload: sanitizedData });

    return res.status(200).json({ source: 'live-upstream', data: sanitizedData });
  } catch (err) {
    next(err);
  }
});

import express from 'express';
import Stripe from 'stripe';

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
const webhookApp = express.Router();

// CRITICAL: Stripe signature verification REQUIRES the raw unparsed byte buffer!
// Do NOT run express.json() before this endpoint!
webhookApp.post(
  '/webhook',
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    const sig = req.headers['stripe-signature'];
    let event;

    try {
      // Cryptographically verify that Stripe sent this payload
      event = stripe.webhooks.constructEvent(
        req.body,
        sig,
        process.env.STRIPE_WEBHOOK_SECRET
      );
    } catch (err) {
      console.error(`⚠️ Webhook signature verification failed:`, err.message);
      return res.status(400).send(`Webhook Error: ${err.message}`);
    }

    // Handle specific event type
    switch (event.type) {
      case 'payment_intent.succeeded':
        const paymentIntent = event.data.object;
        console.log(`💰 Payment succeeded for amount: $${paymentIntent.amount / 100}`);
        // Fulfill order in database: updateUserSubscription(paymentIntent.customer)
        break;

      case 'payment_intent.payment_failed':
        console.warn('❌ Payment failed:', event.data.object.last_payment_error?.message);
        break;
    }

    // Acknowledge receipt to Stripe to stop retries
    res.status(200).json({ received: true });
  }
);

import express from 'express';

const app = express();
app.use(express.json());

// Mock Database
const telemetryNodes = [
  { id: 'node-1', location: 'London', status: 'active' },
  { id: 'node-2', location: 'Tokyo', status: 'active' }
];

// 1. Internal REST Resource (GET all with pagination)
app.get('/api/v1/nodes', (req, res) => {
  res.status(200).json({
    success: true,
    count: telemetryNodes.length,
    data: telemetryNodes
  });
});

// 2. Third-Party Proxy: Fetches external weather for a telemetry node
app.get('/api/v1/nodes/:id/weather', async (req, res) => {
  const node = telemetryNodes.find(n => n.id === req.params.id);
  if (!node) {
    return res.status(404).json({ error: 'Telemetry node not found.' });
  }

  // Simulated safe external API call
  const weatherMock = {
    city: node.location,
    tempC: 18.5,
    humidity: 62,
    source: 'open-meteo-proxy'
  };

  res.status(200).json({
    nodeId: node.id,
    weather: weatherMock
  });
});

// Global 404 Route Fallback
app.use((req, res) => {
  res.status(404).json({
    error: 'Not Found',
    message: `Cannot ${req.method} ${req.originalUrl}`
  });
});

const PORT = 5050;
app.listen(PORT, () => console.log(`🚀 Gateway listening on http://localhost:${PORT}`));